Magic of Kubernetes Sidecar Injection: Present and Future - Anton Ovchinnikov
summary
Explains how automatic sidecar injection actually works: Kubernetes uses mutating admission webhook calls to send pod-creation JSON to an HTTP TLS server which returns a patch; examples include writing a webhook in Go (k8s admission libs) or Python (kopf) and installing generic injectors that read a ConfigMap patch. Notes new kubernetes 1.28 sidecar alpha for init/sidecar lifecycle, and contrasts proxy-per-pod vs node‑level approaches like eBPF/ambient mesh (Cilium) with tradeoffs in latency, resource cost, update blast radius.
AI-written summary · about
chapters (11)
- 0:00Introduction and speaker intro
- 1:03What are sidecar containers
- 6:23Sidecar use cases and examples
- 9:57Kubernetes admission controllers
- 14:17Building custom admission webhooks
- 16:44Tooling for sidecar injection
- 20:55Generic frameworks for injection
- 23:49Limitations of sidecars
- 25:59Sidecarless future with eBPF
- 29:35Future of sidecars and service meshes
- 30:18Closing remarks and tool selection
related talks
29mThe Great Sidecar Debate
27mOperationalizing Kubernetes Sidecars in Production at Salesforce
25mSidecars at Netflix: From Basic Injection to First Class Ci...
27mPragmatic Pod Patterns: Leveraging sidecar containers in Kubernetes
29mKube-Oddities - the quirks that keep Kubernetes interesting
25mRelease the Kraken: Bring Sidecar Containers to Next Level
05mService Mesh Architectures Explained - Sidecar and Beyond
27mProductionise any Application in Kubernetes Using Sidecar Containers